On Mon, Sep 28, 2009 at 06:51:43PM +0100, Alan Buxey wrote: > Hi, > > PS on another note, I've found with the ASA that if you specify > a UDP_TCP rule - eg DNS/53 then it doesnt quite work right. > seperate 53 UDP and 53 TCP, things are fine - i've either mis-understoof > the UDP/TCP logic in the ASA or *its* logic is wrong. and only > one of us can be right... ;-) >
TCP/UDP rules still require two rules to be listed in 7.x and 8.0, one with protocol TCP, one with protocol UDP, or be utilized with a protocol-group of tcp-udp. If you expand the access-list with "show run access-list name", you can see the indidivual rules applied. 8.2 introduces "dual-service-object-group mode" -- meaning you can define a service group WITHOUT the protocol specifiction at the end, and define protocls on a per-service basis: object-group service TEST service-object tcp-udp eq domain service-object tcp eq www service-object icmp echo ! Then utilize it in an ACL: access-list TEST-ACL permit object-group TEST any host 1.2.3.4 -- Brandon Ewing ([email protected])
pgpwFHlupYFHR.pgp
Description: PGP signature
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
